The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization() needs to appear first in the archive and the Lambda with arbitrary code needs to be second.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with     safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via     Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special     config.json (a file within the .keras archive) that will invoke     keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use     the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both     can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization() needs to appear     first in the archive and the Lambda with arbitrary code needs to be second. (CVE-2025-9906)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with
    safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via
    Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special
    config.json (a file within the .keras archive) that will invoke
    keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use
    the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both
    can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization() needs to appear
    first in the archive and the Lambda with arbitrary code needs to be second. (CVE-2025-9906)

ID	Name	Product	Family	Type	Severity
265848	Linux Distros Unpatched Vulnerability : CVE-2025-9906	Nessus	Misc.	Local	high
435376	SCA: security update for keras (GHSA-36fq-jgmw-4r9c)	Tenable Cloud Security	SCA Checks	Local	high
435376	SCA: security update for keras (GHSA-36fq-jgmw-4r9c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-9906

high

Tenable Plugins

high

high

high